Skip to content
OpenAdvisories
High · 7.1 CVE-2023-25074 EUVD-2023-29053GHSA-ffff-jpxq-2jg9

Competency access levels not enforced in the server

Published Jul 24, 2023 · Updated Oct 17, 2024 · Assigned by Gallagher

Vendor: Gallagher Product: Command Centre

Description

Improper privilege validation in Command Centre Server allows authenticated unprivileged operators to modify and view Competencies.

This issue affects Command Centre: vEL8.90 prior to vEL8.90.1318 (MR1), vEL8.80 prior to vEL8.80.1192 (MR2), vEL8.70 prior to vEL8.70.2185 (MR4),

vEL8.60 prior to vEL8.60.2347 (MR6),

vEL8.50 prior to vEL8.50.2831 (MR8), all versions vEL8.40 and prior.

Affected products

VendorProductAffectedFixed
Gallagher Command Centre vEL8.40, vEL8.50 – < 2831, vEL8.60 – < 2347, vEL8.70 – < 2185, vEL8.80 – < 1192, vEL8.90 – < 1318 2831

References